In the Linux kernel, the following vulnerability has been resolved:
libceph: reject buckets with mismatched CRUSH ids
crush_decode() stores bucket data by array slot, and the mapper later
derives the per-bucket workspace index from the decoded bucket id. A
malformed map can therefore make one bucket reuse another bucket's
workspace by encoding an id different from -1 - slot.
For uniform buckets, the second replica selection expands the source
bucket's permutation into that aliased workspace buffer. If the source
bucket is larger than the aliased bucket, the write runs past the smaller
permutation array and can escape the kvmalloc'd CRUSH workspace. KASAN
reports a slab OOB write of 4 bytes in bucket_perm_choose().
Reject buckets whose encoded id does not match their array slot. Valid
CRUSH maps already use the canonical negative id corresponding to the
bucket slot, so this restores the invariant expected by
work->work[-1 - in->id] without changing valid map behavior.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - Malformed CRUSH data arrives in CEPH_MSG_OSD_MAP over TCP from a Ceph monitor (mon_dispatch) or OSD (osd_dispatch); crush_decode() stores attacker-chosen bucket ids and crush_do_rule() later indexes the workspace from those ids with no local syscall.
AC:L - A malicious monitor/OSD fully controls the OSD map and can encode a uniform bucket whose id aliases a smaller bucket's permutation buffer; the second replica expansion in bucket_perm_choose() then deterministically writes past the kvmalloc'd CRUSH workspace without races or rare configs.
PR:N - The attacker acts as the remote Ceph cluster peer delivering a forged osdmap to an already-connected kernel CephFS/RBD client and needs no local account, capabilities, or user-namespace privileges on the victim host.
UI:N - Once a kernel Ceph client session exists, osdmap updates are applied automatically and scan_requests/kick_requests call calc_target()/crush_do_rule() without any further mount, open, or other victim interaction at exploit time.
S:U - The out-of-bounds write corrupts kernel heap on the host running the Ceph client (the CRUSH workspace and adjacent kvmalloc memory), remaining in that kernel security domain rather than crossing a VM, container sandbox, or IOMMU boundary.
C:H - Aliasing a large uniform bucket onto a smaller permutation array performs an attacker-sized slab out-of-bounds write into adjacent kernel heap, which can be leveraged as a memory-corruption primitive for arbitrary kernel reads and information disclosure.
I:H - bucket_perm_choose() writes the source bucket's permutation past the aliased workspace into adjacent kvmalloc memory, giving a kernel heap out-of-bounds write that can be used for control-flow hijacking and arbitrary code execution.
A:H - The slab out-of-bounds write reported by KASAN in bucket_perm_choose() can fault on unmapped adjacent memory or corrupt heap metadata, triggering a kernel oops or panic and complete loss of availability on affected Ceph client hosts.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - Malformed CRUSH data arrives in CEPH_MSG_OSD_MAP over TCP from a Ceph monitor (mon_dispatch) or OSD (osd_dispatch); crush_decode() stores attacker-chosen bucket ids and crush_do_rule() later indexes the workspace from those ids with no local syscall.
AC:L - A malicious monitor/OSD fully controls the OSD map and can encode a uniform bucket whose id aliases a smaller bucket's permutation buffer; the second replica expansion in bucket_perm_choose() then deterministically writes past the kvmalloc'd CRUSH workspace without races or rare configs.
PR:N - The attacker acts as the remote Ceph cluster peer delivering a forged osdmap to an already-connected kernel CephFS/RBD client and needs no local account, capabilities, or user-namespace privileges on the victim host.
UI:N - Once a kernel Ceph client session exists, osdmap updates are applied automatically and scan_requests/kick_requests call calc_target()/crush_do_rule() without any further mount, open, or other victim interaction at exploit time.
S:U - The out-of-bounds write corrupts kernel heap on the host running the Ceph client (the CRUSH workspace and adjacent kvmalloc memory), remaining in that kernel security domain rather than crossing a VM, container sandbox, or IOMMU boundary.
C:H - Aliasing a large uniform bucket onto a smaller permutation array performs an attacker-sized slab out-of-bounds write into adjacent kernel heap, which can be leveraged as a memory-corruption primitive for arbitrary kernel reads and information disclosure.
I:H - bucket_perm_choose() writes the source bucket's permutation past the aliased workspace into adjacent kvmalloc memory, giving a kernel heap out-of-bounds write that can be used for control-flow hijacking and arbitrary code execution.
A:H - The slab out-of-bounds write reported by KASAN in bucket_perm_choose() can fault on unmapped adjacent memory or corrupt heap metadata, triggering a kernel oops or panic and complete loss of availability on affected Ceph client hosts.
CVSS 3.1